All-in-one protocol analysis toolkit: built-in browser capture, MITM proxy, JS hooks, fingerprint spoofing, AI analysis, and an MCP server for seamless AI agent and IDE integration.
THE REPOSITORY DIRECTORY
Protocols
Browse 113 repositories with project descriptions, upstream links, and license information.
About this index
This published selection contains 3,500 captured repository records and 3,309 browsable entries. The 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON.
This repository index is discovered automatically and unreviewed. Categories come from metadata; descriptions have AI-assisted translations. Stars and last-push months are collection-time snapshots.
113 repositories
Selection published: 2026-10-20 UTC
a Python API for your car
SteamKit2 is a .NET library designed to interoperate with Valve's Steam network. It aims to provide a simple, yet extensible, interface to perform various actions on the network.
The RF and reverse engineering framework for everyone. Follow and ★ to show your support!
A toolset for reverse engineering and fuzzing Protobuf-based apps
CAN Commander is a comprehensive tool designed for the reverse engineering of CAN (Controller Area Network) bus systems. This project aims to provide a robust platform for automotive enthusiasts, engineers, and security researchers to interact with and analyze CAN networks, facilitating a deeper understanding and manipulation of communication.
Resources about network security, including: Proxy/GFW/ReverseProxy/Tunnel/VPN/Tor/I2P, and MiTM/PortKnocking/NetworkSniff/NetworkAnalysis/etc。More than 1700 open source tools for now. Post incoming.
Netzob: Protocol Reverse Engineering, Modeling and Fuzzing
Apple Continuity Protocol Reverse Engineering and Dissector
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
Automated Payload Reverse Engineering Pipeline for the Controller Area Network (CAN) protocol
Fichero D11s thermal label printer - BLE protocol reverse engineering and Python CLI tool
Nili is a Tool for Network Scan, Man in the Middle, Protocol Reverse Engineering and Fuzzing.
Deluder is a tool for intercepting traffic of proxy unaware applications. Currently, Deluder supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the box. ⚡
A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University
Cryptographic protocol analysis for real-world protocols.
Selected JavaScript reverse-engineering examples from various websites, with detailed explanations, concept summaries, cryptographic algorithms, difficulty comparisons, and links. Covers challenges including environment reconstruction, extracting JavaScript, webpack, and Ruishu.
MAPS cloud scanner and response parser for Microsoft Defender research.
PowMr Inverter serial communication protocol reverse engineering
Reverse engineering toolkit for Apple's wireless ecosystem
NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces
A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.
ICMPWatch: ICMP Packet Sniffer
Reverse engineering smart ring protocols
“Protocol Informatics” is a project to design for automatically network protocol reverse engineering based on frame or packet analysis. "PI" is short for “Protocol Informatics”, which introduces local and global sequence alignment algorithms. The PI project is famous in network protocol reverse engineering based on network trace. I am not the author of PI project. However, the previous website storing PI project disappeared. That makes me to open a github issue to keep the codes of PI poject.
Self-hosted PCAP analysis platform with LLM-powered incident triage, signature-based threat detection, and AI-generated incident narratives. Features network change monitoring across captures, deep packet inspection via nDPI, and automated Wireshark filter generation. Runs fully offline with local LLMs (Ollama, LM Studio).
A high-performance, lightweight SDK for the GB/T 27930-2023 (Yunkuaichong 1.6) protocol. Its framework-free design targets charging-station/platform integration, simplifying protocol parsing, command generation, and validation.
Daikin BLE controller, protocol reverse engineering
Reverse engineering the client/server communication protocol of Agar.io.
Analysis and basic wrapper library for the Lego Dimensions "Gateway" peripheral
Cross-language packet capture normalizer and collector-inference engine: parse recorded Redis traces into a stable intermediate format (Go) and infer communication patterns from it (Rust).
Wiredigg is a comprehensive network analysis tool with advanced security features designed for network administrators, security professionals, and IT enthusiasts. It provides real-time packet capture, protocol analysis, anomaly detection, and threat identification capabilities in a modern, user-friendly interface.
Vent-Axia wired remote protocol analysis & reverse engineering
Thermal pocket printer - BLE protocol reverse engineering, Python CLI, and web GUI
Bbuzz: a bit-aware network protocol fuzzing and reverse engineering framework
TenkenMe Codex — reverse engineering, protocol analysis, runtime debugging, Skills and MCP workflows.
This is an industrial dataset contains eight different types of ICS protocols, mainly collected for the evaluation of protocol reverse engineering tools. We hope it can be supplemented in the future.
Protocol Reverse Engineering Workbench
Protocol Reverse Engineering Resources
Online engine for reasoning about the Noise Protocol Framework.
Re-implementation of the protocol reverse engineering approach FieldHunter
A lightweight controller offering complete control over all 24 RGB zones of Lenovo Legion LOQ series keyboards through Windows Dynamic Lighting, achieving high-frequency LED refresh rates up to 60 Hz. Built by reverse-engineering the keyboard’s USB protocol using Wireshark packet captures.
Notes and utilities for reverse engineering Agilent PCIe Protocol Analyzers and their host software.
Sonar anti-bot verification bypass for Minecraft. Working 2.1.x sonar bypass script, packet logger, debug proxy. cubixmc poormc tested.
ASUS ZenBook TouchPads I2C HID Protocol Reverse Engineering
AOL Protocol Wiretap Tool - Packet capture and analysis for AOL protocol reverse engineering
Code for experimentation of "Protocol Reverse Engineering Using Neural Networks"
Use AI to automate reverse engineering and protocol analysis as much as possible, and to assist with reviewing large-scale obfuscated codebases. Clone or mirror the repository promptly if needed, in case of a DMCA takedown.
Protocol reverse engineering and simple communication tool for GECO G-422 range of solar pump controllers, used also (but not only) in the Hewalex ZPS-18e
Reverse engineering a 1.8.9 Minecraft server, to mimic it's network protocol
Reverse engineering of splix.io protocol
Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot — using Honeyscore, active auth/state probes, and a weighted score.
Security research on the WhatsApp protocol, cryptographic handshake analysis, reverse engineering, and controlled local MITM experimentation.
Kendo - Powerful Network Packet Capture & Protocol Analysis Software 🚀 Real-time & offline analysis with MFC & WinPcap. Comprehensive protocol parsers & display filters. Efficient packet management. Shortcut keys for seamless user interaction. Explore network traffic effortlessly!
Modbus Attack Tool for Remote Industrial eXploitation (M.A.T.R.I.X) is a comprehensive security testing tool for Modbus TCP protocol implementations.
An all-in-one desktop tool for parsing, framing, checking, sending and receiving power communication protocols. Supports 15 protocols, including China Southern Power Grid, State Grid, DL/T 698.45, DLT645-2007, DLMS/HDLC, next-generation carrier communication and HDC 1.0. Covers single-frame parsing, batch analysis, serial and Bluetooth communication, virtual meters, communication sequence diagrams, test plans and Lua scripts. Portable on Windows; no installation required.
Full reverse engineering of the UBox/UBIA smart-camera P4P protocol: custom block cipher, KCP+RDT video, ICE-style NAT traversal, and a standalone Python client. TUTK IOTC rebadge, documented end-to-end.
open-source AI-assisted USB protocol analysis tool and MCP server
High-throughput network stream inspection for live traffic and PCAPs. Built in Rust with flow reassembly, protocol parsing, transforms, pattern matching, and a real-time Web UI.
Ever want to control Razer Synapse profiles externally? Well now you can
Reverse-engineer iPhone↔device protocols (BLE/WiFi) without a hardware sniffer. Captures decrypted HCI + WiFi via libimobiledevice and rvictl, decodes PTP-IP and Sony private opcodes.
Flow-based PCAP analyzer with protocol-aware inspection, analysis, statistics, reusable indexes, and CLI.
Rust CLI tool for analyzing IoT protocol traffic (CoAP, MQTT, RPL) and assessing post-quantum cryptographic readiness against NIST FIPS 203/204
Bidirectional forwarding between two serial ports for protocol analysis.
Security and reverse-engineering study of DEÜ DEYSİS attendance trust boundaries, with a sanitized Rust mock implementation.
Open, vendor-neutral EMV® 3-D Secure protocol lab for researchers, payment engineers, and educators to visualize browser and app flows, compare spec versions, and inspect trust boundaries.
Reverse engineering of the Bluetooth protocol used by MOONDROP Space Travel TWS earbuds, based on GAIA V3 Protocol. Covers the full protocol stack, including BLE GATT services, ANC control, EQ settings, and firmware updates.
[Network Forensics Series] A browser-based STP/RSTP/Rapid PVST+ analyzer for network engineers. Drop a PCAP file — get a structured event timeline, full FSM reconstruction, root cause analysis with causal chains, topology graph, and zero data leaving your machine.
Profile aMule's External Connect (EC) protocol - a pass-through proxy with a live dashboard, per-caller attribution and session reports.
Reverse engineering the Xiaomi Mi weight scale: BLE advertisement protocol, byte-level frame layouts, an offline decoder and each computed metric traced to its source.
S1 Signal Event Engine - Real-time S1AP protocol analysis and event processing for LTE networks
No description supplied by the upstream repository.
An advanced, security-focused network traffic analysis tool designed for system administrators, cybersecurity professionals, and network engineers. The xsukax PCAP Analyzer provides comprehensive insights into network behavior while maintaining strong privacy protections and offering advanced threat detection capabilities.
Minimalist ICS/OT security research laboratory featuring programmable logic controllers (PLCs), ModbusTCP industrial protocol environments, and network simulation.
Python-based packet sniffer with basic threat detection
Browserless reCAPTCHA v2 solver research — protocol analysis, node-vm BotGuard harness, ONNX tile classifier
Network packet analyzer with protocol dissection and credential extraction using Clojure
ZeroHack is a TypeScript-powered tool that uses AI for advanced network packet analysis, protocol anomaly detection, and cybersecurity threat assessment.
Hannes Software — local-first desktop tools for protocol diagnostics, music workflows, and clinic operations.
An alternative configurator for the J16 GPS tracker: reverse engineering a USB port protocol with no public documentation.
Reverse engineering and runtime analysis of the PackClient modular RAT framework: Launcher and Core internals, protocol reconstruction, tooling, and detection engineering.
CryptoAudit ML analyzes network traffic (PCAP files or live capture) to identify weak, broken, or missing encryption — then attempts to crack it. It combines a 5-model ML ensemble for traffic classification with 15+ decryption methods, persistent key/credential harvesting, and optional Ollama AI integration for traffic analysis.
SIP Protocol Analyzer & Security Auditor - Deep packet inspection for VoIP/SIP traffic with RFC 3261 compliance checking, security vulnerability detection, and call flow analysis
TeleAgent model reverse proxy -> local OpenAI-compatible endpoint (research)
Wireshark dissector plugin for analyzing and decoding network protocols, useful for cybersecurity, packet inspection, and reverse engineering.
Small Audio Post-Processor
ML classifier that predicts security flaws in cryptographic protocol designs using structural features like nonce usage, mutual authentication, and key freshness checks, trained and tested on real protocols including Needham-Schroeder, WPA2, TLS, and Kerberos
Reverse engineering of the JBL PartyBox 100/200/300 wireless TWS link: protocol frames, Linux pairing recipe, and a Python fake-speaker server (play/pause, volume, stereo channels).
A Rust framework for headless Minecraft Java Edition clients — bots, testing, automation, and protocol analysis
Modular OT/ICS protocol fuzzer with plugin support, PCAP replay, and anomaly detection
Reverse engineering of the L&S Emotion Control 2.4 GHz lighting protocol from a KZQ-8YKC-K remote (PIC16F1503 + TI CC2500). Full RF and packet spec recovered by SPI bus sniffing, verified over the air with a HackRF
AI-driven DisplayPort/eDP Protocol Analyzer using MCP (Model Context Protocol)
Systematically extracts and integrates the core designs of external systems through the ORRI methodology, with genuine continuous reinforcement capabilities.
scopeBridge
ProtoAudit is a research-grade toolkit for protocol behavior analysis, cryptographic metadata inspection, and randomness anomaly detection. It helps to identify protocol misuse patterns such as challenge reuse, retry loops, deterministic randomness, and handshake inconsistencies. Designed for protocol research, security analysis, and CTF tasks.
Practical Wireshark network protocol analysis project demonstrating HTTP, DNS, TCP, ARP, and HTTP credential capture with real packet captures, security analysis, and professional documentation.
Complete reverse-engineering analysis of AtomCode CLI (v4.25.3), based on static analysis of the Rust binary and runtime behavior verification. Covers 65+ subsystems including authentication, risk controls, AI communication, and the agent engine.
AI-powered serial port detective: sniff, decode, and annotate UART traffic.
Packet capture and network traffic analysis using Wireshark in an isolated cybersecurity lab.
Hands on packet analysis skills and protocol awareness.
Web app showing live arrivals, departures and security queue times for Sweden's 10 Swedavia airports. Python/FastAPI backend with caching and 43 pytest tests, vanilla JS + Bootstrap frontend.
Reverse-engineer unknown TCP/UDP protocols: record traffic, infer framing/fields/checksums, verify against the live target, then fuzz deterministically with stateful prefixes. Evidence in SQLite, portable exports.
Automated B2C account registration and verification bot for CFS Brands using Python, temporary email integration, and proxy support.
Technical writeups
Security foundations lab covering governance frameworks, forensic investigation, infrastructure auditing, and protocol analysis.
A lightweight Python network traffic monitoring application designed for the CodeAlpha Cybersecurity Internship. The script interfaces with network adapters to capture real-time data packets, decodes Layer 3 and Layer 4 protocol headers (IP, TCP, UDP, ICMP), and extracts raw data payloads for traffic analysis.
Open-source Go library and CLI for lossless Modbus capture files, time-series recording, conversion and replay-ready data.
A beginner-friendly Python Packet Sniffer built using Scapy. Captures and analyzes live TCP, UDP, DNS, ICMP, and ARP packets with protocol parsing, statistics, and packet logging.
Frontend accessibility reconstruction benchmark for replaying CDP AX trees, DOM mutations, node identity, focus, roles, and accessible names across historical browser state.
Browser-based bit slicing and alignment tool for hex data, with bit visualization, pattern matching, and re-sliced output.
Self-hosted BitTorrent tracker-protocol simulator and research toolkit with a modern web UI.
Reconnaissance for unknown Modbus RTU devices: slave discovery, register mapping, evidence-based probing.
Master your network traffic. A powerful Windows desktop tool for crafting, transmitting and monitoring custom Ethernet packets